Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Use static $timestamp instead of time() #93

Merged
merged 2 commits into from
Jun 16, 2016
Merged

Use static $timestamp instead of time() #93

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
bb6d53b
Allow timestamp to be specified rather than relying on PHP time() fun…
josephmcdermott Apr 29, 2016
d6e222c
Commit with Google email address for CLA
josephmcdermott May 3, 2016
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 13 additions & 3 deletions src/JWT.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,6 +29,14 @@ class JWT
*/
public static $leeway = 0;

/**
* Allow the current timestamp to be specified.
* Useful for fixing a value within unit testing.
*
* Will default to PHP time() value if null.
*/
public static $timestamp = null;

public static $supported_algs = array(
'HS256' => array('hash_hmac', 'SHA256'),
'HS512' => array('hash_hmac', 'SHA512'),
Expand Down Expand Up @@ -59,6 +67,8 @@ class JWT
*/
public static function decode($jwt, $key, $allowed_algs = array())
{
$timestamp = is_null(self::$timestamp) ? time() : self::$timestamp;

if (empty($key)) {
throw new InvalidArgumentException('Key may not be empty');
}
Expand Down Expand Up @@ -99,7 +109,7 @@ public static function decode($jwt, $key, $allowed_algs = array())

// Check if the nbf if it is defined. This is the time that the
// token can actually be used. If it's not yet that time, abort.
if (isset($payload->nbf) && $payload->nbf > (time() + self::$leeway)) {
if (isset($payload->nbf) && $payload->nbf > ($timestamp + self::$leeway)) {
throw new BeforeValidException(
'Cannot handle token prior to ' . date(DateTime::ISO8601, $payload->nbf)
);
Expand All @@ -108,14 +118,14 @@ public static function decode($jwt, $key, $allowed_algs = array())
// Check that this token has been created before 'now'. This prevents
// using tokens that have been created for later use (and haven't
// correctly used the nbf claim).
if (isset($payload->iat) && $payload->iat > (time() + self::$leeway)) {
if (isset($payload->iat) && $payload->iat > ($timestamp + self::$leeway)) {
throw new BeforeValidException(
'Cannot handle token prior to ' . date(DateTime::ISO8601, $payload->iat)
);
}

// Check if this token has expired.
if (isset($payload->exp) && (time() - self::$leeway) >= $payload->exp) {
if (isset($payload->exp) && ($timestamp - self::$leeway) >= $payload->exp) {
throw new ExpiredException('Expired token');
}

Expand Down